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AMENDMENTS TO THE CLAIMS 
Below is a listing of claims pending in the application. 

1 . (Original) A method of analyzing network traffic on a network, the network traffic 
having been captured at a network monitoring computer during a period of time, the method comprising: 

at a user computer remote from the network monitoring computer, receiving data points 
corresponding to the captured network traffic, the data points comprising: 

for the captured network traffic, start time, end time, total frames and total bytes; 

and 

information about sections of the captured network traffic, the information 
including start time, end time, number of frames in the section and number of bytes in the 
section; and 

storing a histogram, including the data points, at the user computer. 

2. (Original) The method of claim 1, fiirther comprising at the user computer, 
presenting a user with a graphical user interface representation of the network traffic by graphing byte 
density over time in a capture histogram by using the histogram. 

3. (Original) The method of claim 2, wherein presenting a user with a graphical user 
interface representation of the network traffic comprises: 

including a zoom window, the zoom window useful for highlighting a segment of the 
capture histogram; and 

representing the segment of the capture histogram in a zoom histogram. 

4. (Original) The method of claim 3, further comprising: 

including a data selection window useful for highlighting a segment of the zoom 
histogram; 

storing a first downloaded captured data file that includes sections corresponding to the 
segment of the zoom histogram highlighted by the data selection window; and 

displaying data frames corresponding to the highlighted segment of the zoom window. 
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5. (Original) The method of claim 4, further comprising storing a second downloaded 
captured data file that includes sections corresponding to a segment of the zoom histogram previously 
highlighted by the data selection window. 

6. (Original) The method of claim 4, further comprising storing the first downloaded 
captured data file and the histogram together in a folder. 

7. (Original) The method of claim 2, wherein presenting a user with a graphical user 
interface representation of the network traffic comprises applying a compression algorithm to at least a 
portion of the information in the histogram. 

8. (Original) The method of claim 3, wherein representing the segment of the capture 
histogram in a zoom histogram comprises applying a compression algorithm to at least a portion of the 
information in the histogram. 

9. (Original) The method of claim 4, the histogram further comprising a listing and 
description of downloaded captured data files stored on the user computer, the method further comprising 
using the listing and description of downloaded captured data files to code portions of the capture 
histogram and the zoom histogram with a first indicator representing sections stored at the user computer. 

10. (Original) The method of claim 4, further comprising coding portions of the capture 
histogram and the zoom histogram with a second indicator representing sections that were previously at 
the user computer, but that are not presently at the user computer. 

1 1 . (Original) The method of claim 4, further comprising coding portions of the capture 
histogram and the zoom histogram with a third indicator representing sections that are not stored at the 
user computer or at the network monitoring computer. 
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12. (Original) The method of claim 4, the histogram further comprising a listing and 
description of downloaded captured data files stored on the user computer, the method further 
comprising: 

using the listing and description of downloaded captured data files to color code portions 
of the capture histogram and the zoom histogram with a first color representing sections stored at 
the user computer, 

color coding portions of the capture histogram and the zoom histogram with a second 
color representing sections that were previously at the user computer, but that are not presently at 
the user computer, and 

color coding portions of the capture histogram and the zoom histogram with a third color 
representing sections that are not stored at the user computer or at the network monitoring 
computer. 

1 3 . (Original) The method of claim 4, further comprising: 

downloading sections from the network monitoring computer that are not stored in 
downloaded captured data files at the user computer; and 

combining the downloaded sections with a downloaded captured data file that was 
previously stored at the user computer. 

14. (Original) The method of claim 1, further comprising saving the histogram for later 

use. 

15. (Original) The method of claim 14, fiirther comprising: 
opening the histogram; 

determining if the histogram corresponds to network traffic stored on the network 
monitoring computer using timestamps; 

if the histogram corresponds to network traffic stored on the network monitoring 
computer, establishing a relationship between the network monitoring computer and the user 
computer such that network traffic existing on the network monitoring computer may be 
downloaded to the user computer. 
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16. (Original) The method of claim 4, comprising saving a downloaded captured data 
file stored on the user computer for later use. 

17. (Original) The method of claim 16, comprising: 

creating an individual histogram for the downloaded captured data file stored on the user 
computer for later use; and 

displaying the individual histogram at the user computer. 

18. (Original) A computer readable medium with instructions for performing the 
method of claim 1 . 

19. (Original) A method of managing captured data irom a network, the method 
comprising: 

receiving a portion of the captured data from a remote network monitoring computer, 
storing at least one downloaded captured data file comprising the portion of the captured 
data, the captured data organized into sections; 

storing a histogram, the histogram comprising: 
a first part containing: 

for all of the captured data, information including start time, end time, 
total frames and total bytes; 

for each of the sections, start times, end times, number of frames and 
bytes/sec; and 

a second part that includes a listing and description of the sections that are 
available in downloaded captured data files. 

20. (Currently Amended) The method of claim [[18,]]I9» further comprising displaying a 
graphical user interface representation of the network traffic using information in the histogram. 

21. (Original) The method of claim 20, wherein displaying a graphical user interface 
representation of the network traffic comprises graphing byte density over time. 
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22. (Original) The method of claim 20, further comprising: 

displaying a data selection window that allows a user to select a portion of the graphical 
user interface representation representing a portion of the captured data that the user desires to 
view; 

in response to a user selecting a portion of the graphical user interface representation, 
downloading sections of the captured data that are not stored in downloaded captured data files; 
and 

storing the downloaded sections of the captured data in a downloaded captured data file. 

23. (Currently Amended) A computer readable medium having a plurality of data fields 
representing a data structure, the computer readable medium comprising: 

a first data field containing data representing a histogram used to display a graphical user 
interface representing byte density of captured data over time, the histogram comprising, for 
substantially all of the captured data, start time, end time, total frames, and total bytes and for 
sections of the captured data, start times, end times, number of frames and bytes per second; 

a second data field containing at least section of captured data stored as at least one 
downloaded captured data file representing sections of captured data; and 

a third data field containing data representing a top-level folder for organizing the first 
data field [[filed ]]and the second data field into a file structure. 

24. (Original) The computer readable medium of claim 23, the top level folder having 
the same name as the histogram. 

25. (Original) The computer readable medium of claim 23, the top-level folder being in 
the same location as the histogram. 

26. (Original) The computer readable medium of claim 23, at least one of the 
downloaded captured data files having a name that includes the captured data start time for the section 
captured data stored at the downloaded captured data file. 

27. (Original) The computer readable medium of claim 23, at least one of the 
downloaded captured data files having a name that includes the name of the histogram. 
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28. (Original) The computer readable medium of claim 23, the histogram being created 
from a downloaded captured data file in response to a downloaded captured data file being opened 
directly. 

29. (Original) The computer readable medium of claim 23 at least one of the 
downloaded captured data files being formed from a plurality of downloaded captured data files. 

30. (New) A method comprising: 

receiving, at a user computer remote from a network monitoring computer, data points 
corresponding to data frames captured at the network monitoring computer, 

presenting a user with a graphical user interface representation of network traffic using 
the data points; and 

displaying captured data frames corresponding to a user-highlighted segment of the 
graphical user interface representation. 
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